The AI Engine plugin contains a flaw that allows users with editor privileges to elevate their rights to higher-level roles. This privilege escalation can lead to full site compromise if an editor account is compromised. The weakness is an authorization bypass, identified as CWE‑266.

The vulnerability affects the Meow Apps AI Engine WordPress plugin, all versions 3.4.9 and earlier.

The published CVSS score is 7.2, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. The attack vector is most likely through the WordPress editor interface, requiring that the attacker first obtain an editor role. No external code execution is required; the flaw exploits inadequate role checks.